Unverified Password Change in OctoPrint - CVE-2024-23637
Published: January 31, 2024 / Updated: November 9, 2026
Vulnerability identifier: #VU162902
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-23637
CWE-ID: CWE-620
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an administrator to change passwords for other administrator accounts in OctoPrint without reauthentication.
The vulnerability exists due to missing verification of the acting administrator's password when password changes are submitted through the access control settings. An administrator can use a hijacked administrator account to reset legitimate administrators' passwords and lock them out of their OctoPrint instance.
Affected software
OctoPrint
How to mitigate CVE-2024-23637
Install security update from vendor's website.
OctoPrint - update to 1.10.0